@openclaw-cloud/agent-controller 3.1.1 → 3.1.2

package/dist/utils/write-workspace-files.js

@@ -1,5 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { resolveInsideWorkspace } from '../workspace.js';
+import { toErrorMessage } from './response.js';
 /**
  * Write a map of workspace-relative paths → content into `workspaceDir`.
  *
@@ -21,18 +23,11 @@ export async function writeWorkspaceFiles(files, workspaceDir) {
     await fs.mkdir(workspaceDir, { recursive: true });
     const written = [];
     for (const [filePath, content] of Object.entries(files)) {
-        // Reject any key that escapes the workspace. The file_write handler applies
-        // the same sandbox; writeWorkspaceFiles previously had no guard, so a
-        // backend-supplied key like "../../etc/openclaw/agent.env" or an absolute
-        // path could write outside the workspace.
-        const fullPath = path.join(workspaceDir, filePath);
-        const rel = path.relative(workspaceDir, fullPath);
-        // Segment-aware containment: reject absolute keys and real ".." traversal,
-        // but allow filenames that merely contain ".." (e.g. "notes..v2.md").
-        if (path.isAbsolute(filePath) ||
-            rel === '..' ||
-            rel.startsWith('..' + path.sep) ||
-            path.isAbsolute(rel)) {
+        // Reject any key that escapes the workspace — a backend-supplied key like
+        // "../../etc/openclaw/agent.env" or an absolute path must not write outside
+        // it. Same sandbox helper as the file_write / file_delete handlers.
+        const fullPath = resolveInsideWorkspace(workspaceDir, filePath);
+        if (!fullPath) {
             console.error(`  ✗ ${filePath}: rejected (path escapes workspace)`);
             continue;
         }
@@ -43,7 +38,7 @@ export async function writeWorkspaceFiles(files, workspaceDir) {
             console.log(`  ✓ ${filePath}`);
         }
         catch (err) {
-            console.error(`  ✗ ${filePath}: ${err instanceof Error ? err.message : err}`);
+            console.error(`  ✗ ${filePath}: ${toErrorMessage(err)}`);
         }
     }
     // Make .sh files executable (only the ones we actually wrote)

package/dist/utils/write-workspace-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-workspace-files.js","sourceRoot":"","sources":["../../src/utils/write-workspace-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,YAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAErC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,4EAA4E;QAC5E,sEAAsE;QACtE,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAClD,2EAA2E;QAC3E,sEAAsE;QACtE,IACE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACzB,GAAG,KAAK,IAAI;YACZ,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,qCAAqC,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC"}
+{"version":3,"file":"write-workspace-files.js","sourceRoot":"","sources":["../../src/utils/write-workspace-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,YAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAErC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,qCAAqC,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC"}

package/dist/workspace.d.ts

@@ -10,3 +10,14 @@
  * (which used WORKSPACE_DIR) and backup/knowledge_sync (which used OPENCLAW_STATE_DIR).
  */
 export declare function getWorkspaceDir(): string;
+/**
+ * Resolve a backend-supplied relative path inside `workspaceDir`, or null if it
+ * escapes. The ONE sandbox for every backend-supplied path — `file_write`,
+ * `file_delete` and `writeWorkspaceFiles` all route through it.
+ *
+ * Containment is checked on path *segments* (via `path.relative`), not by
+ * substring. The old `p.includes('..') || p.startsWith('/')` copies in the two
+ * handlers rejected innocent names like `notes..v2.md` and missed Windows
+ * absolute forms such as `C:\x` and `\\server\share`.
+ */
+export declare function resolveInsideWorkspace(workspaceDir: string, relPath: string): string | null;

package/dist/workspace.js

@@ -16,4 +16,24 @@ export function getWorkspaceDir() {
         return config.workspaceDir;
     return path.join(config.stateDir, 'workspace');
 }
+/**
+ * Resolve a backend-supplied relative path inside `workspaceDir`, or null if it
+ * escapes. The ONE sandbox for every backend-supplied path — `file_write`,
+ * `file_delete` and `writeWorkspaceFiles` all route through it.
+ *
+ * Containment is checked on path *segments* (via `path.relative`), not by
+ * substring. The old `p.includes('..') || p.startsWith('/')` copies in the two
+ * handlers rejected innocent names like `notes..v2.md` and missed Windows
+ * absolute forms such as `C:\x` and `\\server\share`.
+ */
+export function resolveInsideWorkspace(workspaceDir, relPath) {
+    if (!relPath || path.isAbsolute(relPath) || path.win32.isAbsolute(relPath))
+        return null;
+    const fullPath = path.resolve(workspaceDir, relPath);
+    const rel = path.relative(workspaceDir, fullPath);
+    if (rel === '' || rel === '..' || rel.startsWith('..' + path.sep) || path.isAbsolute(rel)) {
+        return null;
+    }
+    return fullPath;
+}
 //# sourceMappingURL=workspace.js.map

package/dist/workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAoB,EAAE,OAAe;IAC1E,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw-cloud/agent-controller",
-  "version": "3.1.1",
+  "version": "3.1.2",
   "packageManager": "pnpm@11.5.2",
   "type": "module",
   "engines": {